Legg, Philip A, Buckley, Oliver ORCID: https://orcid.org/0000-0003-1502-5721, Goldsmith, Michael and Creese, Sadie (2016) Caught in the act of an insider attack: detection and assessment of insider threat. In: IEEE International Symposium on Technologies for Homeland Security. The Institute of Electrical and Electronics Engineers (IEEE). ISBN 978-1-4799-1737-2
Preview |
PDF (Accepted manuscript)
- Accepted Version
Download (5MB) | Preview |
Abstract
The greatest asset that any organisation has are its people, but they may also be the greatest threat. Those who are within the organisation may have authorised access to vast amounts of sensitive company records that are essential for maintaining competitiveness and market position, and knowledge of information services and procedures that are crucial for daily operations. In many cases, those who have such access do indeed require it in order to conduct their expected workload. However, should an individual choose to act against the organisation, then with their privileged access and their extensive knowledge, they are well positioned to cause serious damage. Insider threat is becoming a serious and increasing concern for many organisations, with those who have fallen victim to such attacks suffering significant damages including financial and reputational. It is clear then, that there is a desperate need for more effective tools for detecting the presence of insider threats and analyzing the potential of threats before they escalate. We propose Corporate Insider Threat Detection (CITD), an anomaly detection system that is the result of a multi-disciplinary research project that incorporates technical and behavioural activities to assess the threat posed by individuals. The system identifies user and role-based profiles, and measures how users deviate from their observed behaviours to assess the potential threat that a series of activities may pose. In this paper, we present an overview of the system and describe the concept of operations and practicalities of deploying the system. We show how the system can be utilised for unsupervised detection, and also how the human analyst can engage to provide an active learning feedback loop. By adopting an accept or reject scheme, the analyst is capable of refining the underlying detection model to better support their decisionmaking process and significant reduce the false positive rate.
Item Type: | Book Section |
---|---|
Faculty \ School: | Faculty of Science > School of Computing Sciences |
UEA Research Groups: | Faculty of Science > Research Groups > Smart Emerging Technologies Faculty of Science > Research Groups > Cyber Security Privacy and Trust Laboratory |
Depositing User: | Pure Connector |
Date Deposited: | 31 Jan 2018 12:30 |
Last Modified: | 12 Jun 2024 23:45 |
URI: | https://ueaeprints.uea.ac.uk/id/eprint/66161 |
DOI: | 10.1109/THS.2015.7446229 |
Downloads
Downloads per month over past year
Actions (login required)
View Item |